Hi all, I have freeradius working with a Cisco 2000 series controller. A wireless client attempts to associate with a WAP the controller sends an auth request to freeradius who sees the mac address of the user: 00:0e:35:1c:e0:52 Auth-Type := Local, User-Password == "testing" Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "157", # Service-Type = Framed-User, That puts the user in vlan 157, great, it works. So that is for a user whose mac address is known. Now I'd like to work with unknown users. The trouble is once one enable mac address filtering on the Cisco it will alway call to radius. Is there away to allow all MAC addresses to be accepted in the "users" config similar to the above? That way I could throw all unkown users into a restricted access vlan which redirects them to a registration page which in turn takes their mac address and injects it into freeradius thus making them a "known" user and puts them in a normal access vlan... Thanks, Brian _____________________ Brian Ertel Network Administrator Amherst College 413-542-8320 bsertel@amherst.edu _____________________
Brian Ertel wrote:
I have freeradius working with a Cisco 2000 series controller. A wireless client attempts to associate with a WAP the controller sends an auth request to freeradius who sees the mac address of the user:
00:0e:35:1c:e0:52 Auth-Type := Local, User-Password == "testing"
Don't set Auth-Type. User "Cleartext-Password := ...", not "User-Password == ..."
That puts the user in vlan 157, great, it works. So that is for a user whose mac address is known. Now I'd like to work with unknown users. The trouble is once one enable mac address filtering on the Cisco it will alway call to radius. Is there away to allow all MAC addresses to be accepted in the "users" config similar to the above?
List all known MAC addresses first. Then, do: DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff i.e. forcing acceptance or rejection of a user is one of the few times that setting Auth-Type is permitted.
That way I could throw all unkown users into a restricted access vlan which redirects them to a registration page which in turn takes their mac address and injects it into freeradius thus making them a "known" user and puts them in a normal access vlan...
Yup. That's a common configuration. Alan DeKok.
Alan, Thank you for the response. Was your first input: "Don't set Auth-Type. User "Cleartext-Password := ...", not "User-Password == ..." a correction of what I am using or syntax to accomplish the unknown/known user issue? In other words which syntax takes care of the unknown users and which takes care of the known users? I am still unclear about how freeradius identifies and returns values for unknown users. Thank you, Brian -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, August 27, 2007 1:38 AM To: FreeRadius users mailing list Subject: Re: Freeradius, Cisco WLC, Mac address auth. Brian Ertel wrote:
I have freeradius working with a Cisco 2000 series controller. A wireless client attempts to associate with a WAP the controller sends an auth request to freeradius who sees the mac address of the user:
00:0e:35:1c:e0:52 Auth-Type := Local, User-Password == "testing"
Don't set Auth-Type. User "Cleartext-Password := ...", not "User-Password == ..."
That puts the user in vlan 157, great, it works. So that is for a user whose mac address is known. Now I'd like to work with unknown users. The trouble is once one enable mac address filtering on the Cisco it will alway call to radius. Is there away to allow all MAC addresses to be accepted in the "users" config similar to the above?
List all known MAC addresses first. Then, do: DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff i.e. forcing acceptance or rejection of a user is one of the few times that setting Auth-Type is permitted.
That way I could throw all unkown users into a restricted access vlan which redirects them to a registration page which in turn takes their mac address and injects it into freeradius thus making them a "known" user and puts them in a normal access vlan...
Yup. That's a common configuration. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Brian Ertel wrote:
a correction of what I am using or syntax to accomplish the unknown/known user issue?
It's a correction of the entry for a known user. See the README and "man rlm_pap" in 1.1.7.
In other words which syntax takes care of the unknown users and which takes care of the known users?
The second part of my response says how to deal with unknown users.
I am still unclear about how freeradius identifies and returns values for unknown users.
What part of my response was unclear? You asked a question, and I gave an answer immediately following the question... Alan DeKok.
Alan, What I am not clear on is for unknown users you wrote: DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff So for username are you saying I can use any old text string? Also you instructed to list all known mac addresses first should they be "listed" in the following way: 00:0e:35:1c:e0:52 User "Cleartext-Password := ..." Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "157", Thanks for the help. Brian -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, August 27, 2007 8:34 AM To: FreeRadius users mailing list Subject: Re: Freeradius, Cisco WLC, Mac address auth. Brian Ertel wrote:
a correction of what I am using or syntax to accomplish the unknown/known user issue?
It's a correction of the entry for a known user. See the README and "man rlm_pap" in 1.1.7.
In other words which syntax takes care of the unknown users and which takes care of the known users?
The second part of my response says how to deal with unknown users.
I am still unclear about how freeradius identifies and returns values for unknown users.
What part of my response was unclear? You asked a question, and I gave an answer immediately following the question... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Brian Ertel wrote:
DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff
So for username are you saying I can use any old text string?
What leads you to conclude that? Have read the documentation for the "users" file? Do you know what a regular expression is?
Also you instructed to list all known mac addresses first should they be "listed" in the following way:
00:0e:35:1c:e0:52 User "Cleartext-Password := ..."
No, that's not what I said. Go read "man users", and the comments at the top of the "users" file to see what an entry looks like. What you have above is nonsense. The word "User" doesn't belong. You don't need quotes around all of the Cleartext-Password stuff. What you need is: 00:0e:35:1c:e0:52 Cleartext-Password := "whatever_the_password_is" ... vlan stuff And don't ask if the password should be "whatever_the_password_is". Alan DeKok.
Ok. I will do that. Thanks, Brian -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, August 27, 2007 9:12 AM To: FreeRadius users mailing list Subject: Re: Freeradius, Cisco WLC, Mac address auth. Brian Ertel wrote:
DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff
So for username are you saying I can use any old text string?
What leads you to conclude that? Have read the documentation for the "users" file? Do you know what a regular expression is?
Also you instructed to list all known mac addresses first should they be "listed" in the following way:
00:0e:35:1c:e0:52 User "Cleartext-Password := ..."
No, that's not what I said. Go read "man users", and the comments at the top of the "users" file to see what an entry looks like. What you have above is nonsense. The word "User" doesn't belong. You don't need quotes around all of the Cleartext-Password stuff. What you need is: 00:0e:35:1c:e0:52 Cleartext-Password := "whatever_the_password_is" ... vlan stuff And don't ask if the password should be "whatever_the_password_is". Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan, I now have the users file syntax like this: 00:0e:35:1c:e0:52 Cleartext-Password := "testing" Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "157", But when radius returns the following error when attempting to start... /etc/raddb/users[80]: Parse error (check) for entry 00:0e:35:1c:e0:52: Unknown attribute "Cleartext-Password" Errors reading /etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1837] Unknown module "files". radiusd.conf[1773] Failed to parse authorize section. Brian. -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, August 27, 2007 9:12 AM To: FreeRadius users mailing list Subject: Re: Freeradius, Cisco WLC, Mac address auth. Brian Ertel wrote:
DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff
So for username are you saying I can use any old text string?
What leads you to conclude that? Have read the documentation for the "users" file? Do you know what a regular expression is?
Also you instructed to list all known mac addresses first should they be "listed" in the following way:
00:0e:35:1c:e0:52 User "Cleartext-Password := ..."
No, that's not what I said. Go read "man users", and the comments at the top of the "users" file to see what an entry looks like. What you have above is nonsense. The word "User" doesn't belong. You don't need quotes around all of the Cleartext-Password stuff. What you need is: 00:0e:35:1c:e0:52 Cleartext-Password := "whatever_the_password_is" ... vlan stuff And don't ask if the password should be "whatever_the_password_is". Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, 2007-08-27 at 09:42 -0400, Brian Ertel wrote:
Alan,
I now have the users file syntax like this:
00:0e:35:1c:e0:52 Cleartext-Password := "testing"
Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "157",
Remove the blank line, remove the comma from the last entry (Tunnel-Private-Group-Id). While you're at it, (re)read the "man 5 users" page more carefully
Brian Ertel wrote:
Unknown attribute "Cleartext-Password"
Use 1.1.7. It contains MAY bug fixes, security fixes, and features over previous versions. If you're not going to use 1.1.7, just use User-Password instead of Cleartext-Password. But you SHOULD use ":=" for the operator, rather than "==", as in your first example. Alan DeKok.
Alan DeKok wrote:
Brian Ertel wrote:
DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff
So for username are you saying I can use any old text string?
*([0-9a-fA-F]:){5}[0-9a-fA-F] unless you want to match 0:50 ;)
What leads you to conclude that? Have read the documentation for the "users" file? Do you know what a regular expression is?
Also you instructed to list all known mac addresses first should they be "listed" in the following way:
00:0e:35:1c:e0:52 User "Cleartext-Password := ..."
No, that's not what I said.
Go read "man users", and the comments at the top of the "users" file to see what an entry looks like. What you have above is nonsense. The word "User" doesn't belong. You don't need quotes around all of the Cleartext-Password stuff. What you need is:
00:0e:35:1c:e0:52 Cleartext-Password := "whatever_the_password_is" ... vlan stuff
And don't ask if the password should be "whatever_the_password_is".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Arran Cudbard-Bell wrote:
Alan DeKok wrote:
Brian Ertel wrote:
DEFAULT User-Name =~ "([0-9a-fA-F]:)5[0-9a-fA-F]", Auth-Type := Accept ... vlan stuff
So for username are you saying I can use any old text string?
*([0-9a-fA-F]:){5}[0-9a-fA-F] unless you want to match
0:50 ;) Make that
([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}
What leads you to conclude that? Have read the documentation for the "users" file? Do you know what a regular expression is?
Also you instructed to list all known mac addresses first should they be "listed" in the following way: 00:0e:35:1c:e0:52 User "Cleartext-Password := ..."
No, that's not what I said.
Go read "man users", and the comments at the top of the "users" file to see what an entry looks like. What you have above is nonsense. The word "User" doesn't belong. You don't need quotes around all of the Cleartext-Password stuff. What you need is:
00:0e:35:1c:e0:52 Cleartext-Password := "whatever_the_password_is" ... vlan stuff
And don't ask if the password should be "whatever_the_password_is".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Brian Ertel -
Phil Mayers